Most growing companies have no idea how many local admin accounts exist across their Mac fleet. Not because they don’t care — but because nobody has ever checked.
Local admin accounts are user accounts on a Mac that have full administrator privileges. They can install software, change system settings, and access files without restriction. When they belong to current employees with a legitimate reason — fine. When they belong to ex-employees, contractors, or unknown users — they are a live security risk sitting on every affected device.
This is not a rare edge case. It is one of the most consistent findings when I start working with a new client.
Why Unknown Admin Accounts Happen
In fast-growing teams, Macs are often set up manually — by whoever has time, usually a developer or the most technical person in the office. Each time a device is configured, a local admin account gets created. Sometimes it’s the user’s own account. Sometimes it’s a generic ‘admin’ account used for setup and never removed. Sometimes it belongs to an IT contractor who left two years ago.
Without a Mobile Device Management (MDM) system enforcing policies across the fleet, these accounts accumulate quietly. Nobody audits them. Nobody removes them. And if the device is ever lost, stolen, or accessed by someone who shouldn’t have it — those accounts are the door in.
The Risk in Plain Terms
An active local admin account on a company Mac means:
- Anyone who knows (or can guess) the password can access the device with full privileges
- Software can be installed, settings changed, and security controls bypassed
- Company data on that device can be accessed, copied, or deleted
- If the device is unmanaged and unencrypted, there is no remote wipe capability
For companies handling client data, financial records, or personal information under GDPR — this is not just an IT inconvenience. It is a potential breach.
How to Audit Local Admin Accounts on macOS
If you do not have an MDM in place, you can run a manual audit. On each Mac, open Terminal and run:
dscl . list /Users | grep -v ‘^_’
This returns all user accounts on the device. Then check which ones have admin privileges:
dscl . read /Groups/admin GroupMembership
Cross-reference the results with your current employee list. Any account that doesn’t belong to an active employee with a documented reason for admin access should be investigated and removed.
If you have 10 devices, this takes an afternoon. If you have 40 devices, this is a project. If you have 80 devices — you need an MDM.
How MDM Solves This at Scale
A properly configured MDM (Kandji, JumpCloud, or Microsoft Intune for mixed fleets) gives you:
- A real-time inventory of every user account on every enrolled device
- The ability to enforce a policy that prevents unauthorised local admin creation
- Automated alerts when a new admin account appears on any device
- Remote removal of accounts without touching the physical device
This is one of the first things I set up with every new client. The audit usually takes less than an hour with the right tooling. The findings almost always surprise people.
What to Do Right Now
If you don’t have an MDM and you have more than 10 company Macs, do the manual audit above this week. Document what you find. Remove any accounts that don’t belong to current staff with a documented need.
If you have an MDM already, check whether you have a policy enforcing local admin restrictions — many companies have MDM enrolled but haven’t configured this specific control.
If you want a structured view of where your Mac fleet stands across all major risk areas — device management, access control, policies, and security — the assessment tool below covers all of it in about 15 minutes.
Run a free IT risk assessment for your team at itops.zlefterov.com — no email required. It covers device management, access control, offboarding, and more, and gives you a prioritised list of what to fix first.